spring-projects/spring-security · error · ServerExchangeRejectedException

The request was rejected because the parameter

Error message

The request was rejected because the parameter: "<name> " has a value "<value>" that is not allowed.

What it means

StrictServerWebExchangeFirewall validates every request parameter value against the configured allowedParameterValues predicate. When a parameter value fails the predicate, the firewall rejects the whole exchange with ServerExchangeRejectedException before the request reaches any handler. This is Spring Security's strict-mode blocklist/allowlist mechanism for parameter values (e.g. blocking encoded attacks).

Solutions

1. Inspect the rejected parameter name/value in the exception message and either fix the client to send allowed values
2. Extend the allowedParameterValues predicate to permit the legitimate value (e.g. add to the allowlist or relax the test)
3. If the request is malicious/unexpected, keep the rejection and investigate the client
4. Temporarily log rejected values via the rejected handler to tune the allowlist before relaxing it

Example fix

// before
http.protocolLogin(...) ; firewall allowing only ["a","b"]
.parameterValue(value -> value.in("a","b"))
// after
.parameterValue(value -> value.in("a","b","c") || value.matches("[a-z0-9-]+"))

// client-side check before sending
if (!allowedValues.contains(paramValue)) {
    throw new IllegalArgumentException("Value not allowed for parameter " + paramName);
}

// server-side: reject with 400, never leak internals
try {
    return chain.filter(exchange);
} catch (ServerExchangeRejectedException ex) {
    response.setStatusCode(HttpStatus.BAD_REQUEST);
    return response.setComplete();
}

When it happens

Trigger: A request arrives containing a query or form parameter whose value does not pass the Predicate<String> configured via StrictServerWebExchangeFirewall/ServerHttpSecurity .requestCache()/.parameterValue allowlist customization (or the default allowed set). Any endpoint receives a parameter value outside the allowlist.

Common situations: Developers tighten the firewall with a strict allowedParameterValues predicate and forget legitimate values (e.g. values containing encoded characters, commas, or special tokens); clients send values the allowlist wasn't updated for after a feature change; security scans/bots send malicious parameter values.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• Amount of performance parameters invalid
• Bad number of rounds
• Invalid encoded Argon2-hash
• Invalid iterations parameter
• Invalid len

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/9bfa415add78f736. Report an issue: GitHub.

Appendix: source

Thrown at web/src/main/java/org/springframework/security/web/server/firewall/StrictServerWebExchangeFirewall.java:656

	}

	private void validateAllowedHeaderValue(Object key, @Nullable String value) {
		if (!StrictServerWebExchangeFirewall.this.allowedHeaderValues.test(value)) {
			throw new ServerExchangeRejectedException("The request was rejected because the header: \"" + key
					+ " \" has a value \"" + value + "\" that is not allowed.");
		}
	}

	private void validateAllowedParameterName(String name) {
		if (!StrictServerWebExchangeFirewall.this.allowedParameterNames.test(name)) {
			throw new ServerExchangeRejectedException(
					"The request was rejected because the parameter name \"" + name + "\" is not allowed.");
		}
	}

	private void validateAllowedParameterValue(String name, String value) {
		if (!StrictServerWebExchangeFirewall.this.allowedParameterValues.test(value)) {
			throw new ServerExchangeRejectedException("The request was rejected because the parameter: \"" + name
					+ " \" has a value \"" + value + "\" that is not allowed.");
		}
	}

	private static boolean encodedUrlContains(ServerHttpRequest request, String value) {
		if (valueContains(request.getPath().value(), value)) {
			return true;
		}
		return valueContains(request.getURI().getRawPath(), value);
	}

	private static boolean decodedUrlContains(ServerHttpRequest request, String value) {
		return valueContains(request.getURI().getPath(), value);
	}

	private static boolean containsOnlyPrintableAsciiCharacters(String uri) {
		if (uri == null) {
			return true;

View on GitHub (pinned to 96852e8860)